Just a few days ago Patio11 mentioned that the only good thing about the recent security issues was that Rails didn't have an app similar to wordpress that would be installed everywhere and never updated.
And now, this.
And what's, er, worse? PHP everywhere, or Ruby everywhere?
I'm concerned that the relative complexity of upgrading a Rails app with bundler and application server, webserver, etc is significant compared to the steps to upgrade the average PHP app (copy the new files over the old ones).
Then again, perhaps an even bigger threat is people who feel smug about security due to their choice of programming language, which is what you seem to be hinting at.
I dislike PHP as much as the next guy, but if your goal really is ubiquity, you've forgotten a decently large segment of the e-population. :-/
Though if I were doing anything installable I'd put a channel for security notices on the admin panel like Wordpress does.
That being said, I'm hesitant to try this until ruby calms down a bit.
The barrier to entry for deploying a Rails app is high enough that it's unlikely a significant number of deployments will be installed and forgotten like so many PHP packages.
(Not trying to be snippy, but really, what is your point?)